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DETAILED ACTION 

Response to Arguments 

1 . Applicant's arguments filed have been fully considered but they are not 
persuasive. 

The applicant argues that the amended limitations "whereby said scanner 
reintroduces to the communication channel all, some, or none of the intercepted code" 
is not taught by both Hawe and Ranger. 

The examiner respectfully disagrees, the teachings of Ranger are relied upon for 
disclosing that the scanner reintroduces to the communication channel all, some, or 
none of the intercepted code, see column 4, lines 38-50 and column 6, lines 24-28 & 
32-43. Ranger indicates that the decrypted file is scanned for viruses prior to being 
transmitted to other computers. The file is either sent as a whole, or with the viral 
information removed, or the file is blocked from transmission and a message is sent to 
the user. The examiner notes that these limitations are only recited in independent 
claims 1 and 14. 

It is additionally argued by the applicant that the examiner has not shown a 
teaching of "a protocol parser with intercepts which intercepts code traveling on a 
communication channel and transmits the code for review by a code scanner, wherein 
the code is reintroduced to the communication channel". The applicant indicates that 
examiner deems the structure protocol parser as being a control state machine. 
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The examiner disagrees with the applicant's assertions. Hawe indeed does 
intercept code since it is disclosed that parsing of incoming packets is used to identify 
the protocol to generate the packet and extracting sufficient information from the packet 
header to determine if, and what type of encryption is needed, see column 10, lines 38- 
44. Some means is necessary in order to determine how to parse the packets in order 
to determine the protocol type, Hawe does disclose of the use of a control state 
machine as indicated by the applicant, however if the claimed "protocol parser" is 
different from the prior art of record, the claims do not distinguish that different. The 
examiner is broadly interpreting the protocol parser as determining the type of protocol 
the packet is. The teachings of Ranger are relied upon for disclosing that the scanner 
reintroduces to the communication channel all, some, or none of the intercepted code, 
see column 4, lines 38-50 and column 6, lines 24-28 & 32-43. Ranger indicates that the 
decrypted file is scanned for viruses prior to being transmitted to other computers. The 
file is either sent as a whole, or with the viral information removed, or the file is blocked 
from transmission and a message is sent to the user. 

2. In response to applicant's argument that the references fail to show certain 
features of applicant's invention, it is noted that the features upon which applicant relies 
(i.e., wherein the code is reintroduced to the communication channel) are not recited in 
the rejected claims 7 and 8. Although the claims are interpreted in light of the 
specification, limitations from the specification are not read into the claims. See In re 
Van Geuns, 988 F.2d 1181, 26 USPQ2d 1057 (Fed. Cir. 1993). 
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3. The applicant has indicated that if the examiner maintains the nonstatutory 
obviousness-type double patenting rejection, a terminal disclaimer would be filed. The 
examiner is maintaining the obviousness-type double patenting rejection. 



Double Patenting 

4. The nonstatutory double patenting rejection is based on a judicially created 
doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the 
unjustified or improper timewise extension of the "right to exclude" granted by a patent 
and to prevent possible harassment by multiple assignees. A nonstatutory 
obviousness-type double patenting rejection is appropriate where the conflicting claims 
are not identical, but at least one examined application claim is not patentably distinct 
from the reference claim(s) because the examined application claim is either anticipated 
by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 
F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 
USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 
1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 
F.2d 438, 164 USPQ 619 (CCPA 1970); and In re Thorington, 418 F.2d 528, 163 USPQ 
644 (CCPA 1969). 

A timely filed terminal disclaimer in compliance with 37 CFR 1 .321 (c) or 1 .321 (d) 
may be used to overcome an actual or provisional rejection based on a nonstatutory 
double patenting ground provided the conflicting application or patent either is shown to 
be commonly owned with this application, or claims an invention made as a result of 
activities undertaken within the scope of a joint research agreement. 

Effective January 1 , 1994, a registered attorney or agent of record may sign a 
terminal disclaimer. A terminal disclaimer signed by the assignee must fully comply 
with 37 CFR 3.73(b). 

5. Claims 1-14 are provisionally rejected on the ground of nonstatutory 
obviousness-type double patenting as being unpatentable over claims 4-17 of 
copending Application No. 09/800,328. Although the conflicting claims are not identical, 
they are not patentably distinct from each other because claims 1-14 of the instant 
application are envisioned by copending Application No. 09/800,328 in that claims 4-17 
of the copending application contain all the limitations of claims 1-14 of the instant 
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application. Claims 1-14 of the instant application therefore is not patentably distinct 
from the copending application, and as such, is unpatentable for obvious-type double 
patenting. 

This is a provisional obviousness-type double patenting rejection because the 
conflicting claims have not in fact been patented. 

6. Claims 1-14 are provisionally rejected on the ground of nonstatutory 
obviousness-type double patenting as being unpatentable over 1-36 of copending 
Application No. 10/655,387. Although the conflicting claims are not identical, they are 
not patentably distinct from each other because claims 1-14 of the instant application 
are envisioned by copending Application No. 10/655,387 in that claims 1-36 of the 
copending application contain all the limitations of claims 1-14 of the instant application. 
Claims 1-14 of the instant application therefore is not patentably distinct from the 
copending application, and as such, is unpatentable for obvious-type double patenting. 

This is a provisional obviousness-type double patenting rejection because the 
conflicting claims have not in fact been patented. 

7. Claims 1-14 are provisionally rejected on the ground of nonstatutory 
obviousness-type double patenting as being unpatentable over claims 1-12 of 
copending Application No. 09/838,979. Although the conflicting claims are not identical, 
they are not patentably distinct from each other because claims 1-14 of the instant 
application are envisioned by copending Application No. 09/838,979 in that claims 1-12 
of the copending application contain all the limitations of claims 1-14 of the instant 
application. Claims 1-14 of the instant application therefore is not patentably distinct 
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from the copending application, and as such, is unpatentable for obvious-type double 
patenting. 

This is a provisional obviousness-type double patenting rejection because the 
conflicting claims have not in fact been patented. 

Claim Rejections - 35 USC § 103 

8. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

9. Claims 1-14 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Hawe et al, U.S. Patent 5,070,528 in view of Ranger et al, U.S. Patent 6,393,568. 

As per claims 1 and 14, it is taught by Howe et al of an apparatus and method for 
intercepting and processing code on a communications channel. The protocol is parsed 
(by means of a protocol parser) and then transferred to be decrypted (by means of a 
decryption component)(col. 10, lines 38-44 and col. 10, line 63 through col. 11, line 1) 
and it is interpreted by the examiner that the code is intercepted by the protocol parsing 
means as it is transmitted through the communication channel since it is disclosed by 
Hawe et al that the basic step of identifying the protocol (by means of a protocol 
scanner) used to generate the packets determines which type of encryption is needed 
(col. 10, lines 38-44). The teachings of Hawe et al fail to disclose of a proscribed code 
scanner that scans the decrypted code and that the scanner reintroduces to the 
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communication channel all, some, or none of the intercepted code. It is disclosed by 
Ranger et al that encrypted information is decrypted prior to scanning by a content 
inspection mechanism (proscribed code scanner)(col. 2, lines 40-43 & 58-61). Ranger 
et al teaches of indicating the presence of the proscribed code if the indicator is positive 
(col. 6, lines 32-43). The scanner reintroduces to the communication channel all, some, 
or none of the intercepted code (col. 4, lines 38-50 and col. 6, lines 24-28 & 32-43). It 
would have been obvious to a person of ordinary skill in the art at the time of the 
invention to have been motivated to apply decryption prior to scanning for viruses. 
Ranger et al discloses motivational benefits by decrypting code prior to scanning for 
viruses by reciting by discussing a need for detecting viruses in communications 
received in encrypted form such that it would provide virus detection in real time for a 
communication system (col. 1, lines 58-64) and virus programs are not able to decrypt 
encrypted information (col. 1 , lines 21-23). It would have been obvious that the 
teachings of Hawe et al would have found the teachings of Ranger et al beneficial as a 
means of efficiently scanning encrypted files for viruses by decrypting the files prior to 
scanning for viruses to provide real time content inspection for viruses. 

As per claims 2 and 3, Hawe et al discloses of intercepting code prior to 
decrypting the encrypted code (col. 10, lines 38-44). It is interpreted by the examiner 
that the secure/altered code is intercepted by the protocol parsing means in as it is 
transmitted through the communication channel since it is disclosed by Hawe et al that 
the basic step of identifying the protocol (by means of a protocol scanner) used to 
generate the packets determines which type of encryption is needed (col. 10, lines 38- 
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44). Ranger et al is relied upon for disclosing that encrypted information is decrypted 
prior to scanning by a content inspection mechanism (proscribed code scanner in a 
separate system)(col. 2, lines 40-43 & 58-61). The presence of the proscribed code is 
indicated if the indicator is positive (by means of an indicator)(col. 6, lines 32-43). 
Please refer above for the motivational benefits of the teachings of Ranger et al as 
applied to Hawe et al. 

As per claims 4 and 13, Ranger et al teaches of scanning the code for the 
presence of proscribed code further comprising scanning the code for the presence of 
viruses (col. 6, lines 32-43). 

As per claims 5,6, and 1 1 , it is interpreted by the examiner that the code is 
configured for interception parameters by the protocol parsing means in as it is 
transmitted through the communication channel since it is disclosed by Hawe et al that 
the basic step of identifying the protocol (by means of a protocol scanner preconfigured) 
used to generate the packets determines which type of encryption is needed (col. 10, 
lines 38-44). 

As per claims 7 and 8, it is taught by Howe et al of an apparatus and method for 
intercepting and processing code on a communications channel. The protocol is parsed 
(by means of a protocol parser) and then transferred to be decrypted (by means of a 
decryption component)(col. 10, lines 38-44 and col. 10, line 63 through col. 11, line 1) 
and it is interpreted by the examiner that the code is intercepted by the protocol parsing 
means as it is transmitted through the communication channel since it is disclosed by 
Hawe et al that the basic step of identifying the protocol (by means of a protocol 
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scanner) used to generate the packets determines which type of encryption is needed 
(col. 10, lines 38-44). The teachings of Hawe et al fail to disclose of a proscribed code 
scanner that scans the decrypted code. It is disclosed by Ranger et al that encrypted 
information is decrypted prior to scanning by a content inspection mechanism 
(proscribed code scanner)(col. 2, lines 40-43 & 58-61). Ranger et al teaches of 
indicating the presence of the proscribed code if the indicator is positive (col. 6, lines 32- 
43). It would have been obvious to a person of ordinary skill in the art at the time of 
the invention to have been motivated to apply decryption prior to scanning for viruses. 
Ranger et al discloses motivational benefits by decrypting code prior to scanning for 
viruses by reciting by discussing a need for detecting viruses in communications 
received in encrypted form such that it would provide virus detection in real time for a 
communication system (col. 1 , lines 58-64) and virus programs are not able to decrypt 
encrypted information (col. 1 , lines 21-23). It would have been obvious that the 
teachings of Hawe et al would have found the teachings of Ranger et al beneficial as a 
means of efficiently scanning encrypted files for viruses by decrypting the files prior to 
scanning for viruses to provide real time content inspection for viruses. 

As per claim 9, Ranger et al discloses of re-encrypting (returning) code if it is fully 
trusted (indicator is negative)(col. 7, lines 20-27). Please refer above for the 
motivational benefits of the teachings of Ranger et al as applied to Hawe et al. 

As per claim 10, Ranger et al teaches of indicating the presence of the 
proscribed code if the indicator is positive (col. 6, lines 32-43). Please refer above for 
the motivational benefits of the teachings of Ranger et al as applied to Hawe et al. 
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As per claim 12, Hawe et al discloses of intercepting code prior to decrypting the 
encrypted code (col. 10, lines 38-44). Ranger et al is relied upon for disclosing that 
encrypted information is decrypted prior to scanning by a content inspection mechanism 
(proscribed code scanner in a separate system)(col. 2, lines 40-43 & 58-61). The 
presence of the proscribed code is indicated if the indicator is positive occurring on a 
separate machine (col. 6, lines 32-43). Please refer above for the motivational benefits 
of the teachings of Ranger et al as applied to Hawe et al. 

Conclusion 

10. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1 .1 36(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1 .136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the mailing date of this final action. 

1 1 . Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Christopher A. Revak whose telephone number is 571- 
272-3794. The examiner can normally be reached on Monday-Friday, 6:30am-3:00pm. 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz Sheikh can be reached on 571-272-3795. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 
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